[#17055] Set#map! vs. map — "David A. Black" <dblack@...>

Hi --

23 messages 2008/06/03

[#17084] Enumerable::Enumerator#with_memo — "Akinori MUSHA" <knu@...>

Hi,

36 messages 2008/06/03
[#17168] Re: Enumerable::Enumerator#with_memo — David Flanagan <david@...> 2008/06/09

Akinori MUSHA wrote:

[#17173] Re: Enumerable::Enumerator#with_memo — "Jeremy Kemper" <jeremy@...> 2008/06/10

On Mon, Jun 9, 2008 at 12:11 PM, David Flanagan <david@davidflanagan.com> wrote:

[#17192] Re: Enumerable::Enumerator#with_memo — "Martin DeMello" <martindemello@...> 2008/06/10

On Mon, Jun 9, 2008 at 10:57 PM, Jeremy Kemper <jeremy@bitsweat.net> wrote:

[#17162] Release Plan: Ruby 1.9.0-2 — SASADA Koichi <ko1@...>

Hi,

44 messages 2008/06/09
[#17254] Re: Release Plan: Ruby 1.9.0-2 — SASADA Koichi <ko1@...> 2008/06/15

Hi,

[#17273] Re: Release Plan: Ruby 1.9.0-2 — Ryan Davis <ryand-ruby@...> 2008/06/16

[#17276] Re: Release Plan: Ruby 1.9.0-2 — Kouhei Sutou <kou@...> 2008/06/16

Hi,

[#17312] Re: Release Plan: Ruby 1.9.0-2 — Ryan Davis <ryand-ruby@...> 2008/06/18

[#17346] Re: Release Plan: Ruby 1.9.0-2 — Kouhei Sutou <kou@...> 2008/06/19

Hi,

[#17167] Mail count in Subject — "Dirk Traulsen" <dirk.traulsen@...>

Hi!

20 messages 2008/06/09
[#17169] Re: Mail count in Subject — "Warren Brown" <warrenb@...> 2008/06/09

All,

[#17171] Re: Mail count in Subject — Urabe Shyouhei <shyouhei@...> 2008/06/10

Warren Brown wrote:

[#17327] A plea for a release process — Brian Ford <brixen@...>

Hi all,

15 messages 2008/06/18

[#17377] Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix) — "Bill Kelly" <billk@...>

Hi,

12 messages 2008/06/23

[#17393] URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — "Igal Koshevoy" <igal@...>

All currently available versions of MRI Ruby are either vulnerable to

104 messages 2008/06/24
[#17416] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Urabe Shyouhei <shyouhei@...> 2008/06/28

Sorry for a late reply but I think I've fixed this issue. Can someone

[#17417] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Igal Koshevoy <igal@...> 2008/06/28

Urabe Shyouhei wrote:

[#17419] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Urabe Shyouhei <shyouhei@...> 2008/06/28

Igal Koshevoy wrote:

[#17422] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Igal Koshevoy <igal@...> 2008/06/29

Urabe Shyouhei wrote:

[#17426] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Urabe Shyouhei <shyouhei@...> 2008/06/29

Igal Koshevoy wrote:

[#17438] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Igal Koshevoy <igal@...> 2008/06/29

Urabe Shyouhei wrote:

[#17499] We'll release 1.8.6/1.8.7 this Friday — Urabe Shyouhei <shyouhei@...> 2008/07/02

Hello, I think current 1.8.6/1.8.7 is stable than p230/p22, so I decided

[#17504] Re: We'll release 1.8.6/1.8.7 this Friday — "Vladimir Sizikov" <vsizikov@...> 2008/07/02

Hi Urabe,

[#17506] Re: We'll release 1.8.6/1.8.7 this Friday — Charles Oliver Nutter <charles.nutter@...> 2008/07/02

Vladimir Sizikov wrote:

[#17521] Re: We'll release 1.8.6/1.8.7 this Friday — Urabe Shyouhei <shyouhei@...> 2008/07/03

Charles Oliver Nutter wrote:

[#17544] Re: We'll release 1.8.6/1.8.7 this Friday — Igal Koshevoy <igal@...> 2008/07/03

Urabe Shyouhei wrote:

[#17545] Re: We'll release 1.8.6/1.8.7 this Friday — Charles Oliver Nutter <charles.nutter@...> 2008/07/03

Igal Koshevoy wrote:

[#17806] Re: We'll release 1.8.6/1.8.7 this Friday — "Michal Suchanek" <hramrach@...> 2008/07/16

On 02/07/2008, Charles Oliver Nutter <charles.nutter@sun.com> wrote:

[#17851] Re: We'll release 1.8.6/1.8.7 this Friday — Tanaka Akira <akr@...> 2008/07/19

In article <a5d587fb0807160533r4534fabdg257b4a9523b15f1e@mail.gmail.com>,

[#17852] Re: We'll release 1.8.6/1.8.7 this Friday — Federico Builes <federico.builes@...> 2008/07/19

[#17855] Re: We'll release 1.8.6/1.8.7 this Friday — Jeremy Henty <onepoint@...> 2008/07/19

On Sat, Jul 19, 2008 at 02:18:05PM +0900, Federico Builes wrote:

[#17857] Re: We'll release 1.8.6/1.8.7 this Friday — Federico Builes <federico.builes@...> 2008/07/19

[#17860] Re: We'll release 1.8.6/1.8.7 this Friday — Jeremy Henty <onepoint@...> 2008/07/19

On Sun, Jul 20, 2008 at 12:43:46AM +0900, Federico Builes wrote:

[#17939] Re: We'll release 1.8.6/1.8.7 this Friday — Kurt Stephens <ks@...> 2008/07/24

When will we see a new 1.8.6 release?

[#17940] Re: We'll release 1.8.6/1.8.7 this Friday — Nobuyoshi Nakada <nobu@...> 2008/07/24

Hi,

[#17941] Re: We'll release 1.8.6/1.8.7 this Friday — "Vladimir Sizikov" <vsizikov@...> 2008/07/24

Hi,

[#17945] Re: We'll release 1.8.6/1.8.7 this Friday — Jeremy Henty <onepoint@...> 2008/07/24

On Fri, Jul 25, 2008 at 02:04:15AM +0900, Vladimir Sizikov wrote:

[#17946] Re: We'll release 1.8.6/1.8.7 this Friday — Jeremy Henty <onepoint@...> 2008/07/24

On Fri, Jul 25, 2008 at 04:35:43AM +0900, Jeremy Henty wrote:

[#17947] Re: We'll release 1.8.6/1.8.7 this Friday — Federico Builes <federico.builes@...> 2008/07/24

Jeremy,

[#17948] Re: We'll release 1.8.6/1.8.7 this Friday — Nobuyoshi Nakada <nobu@...> 2008/07/25

Hi,

[#17953] Re: We'll release 1.8.6/1.8.7 this Friday — "Daniel Luz" <dev@...> 2008/07/25

On Thu, Jul 24, 2008 at 9:19 PM, Nobuyoshi Nakada <nobu@ruby-lang.org>

[#17423] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Tanaka Akira <akr@...> 2008/06/29

In article <48662E99.7030508@pragmaticraft.com>,

[#17424] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Federico Builes <federico.builes@...> 2008/06/29

[#17429] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — Igal Koshevoy <igal@...> 2008/06/29

Federico Builes wrote:

[#17431] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk — "M. Edward (Ed) Borasky" <znmeb@...> 2008/06/29

Igal Koshevoy wrote:

[#17427] 1.8 release management — Yukihiro Matsumoto <matz@...>

Hi,

43 messages 2008/06/29
[#17455] Re: 1.8 release management — Stephen Bannasch <stephen.bannasch@...> 2008/06/30

Let me describe some simple questions about Ruby 1.8.6 that are not

[#17458] Re: 1.8 release management — Urabe Shyouhei <shyouhei@...> 2008/06/30

For what I know,

[#17547] Re: 1.8 release management — "Wilson Bilkovich" <wilsonb@...> 2008/07/03

On 6/30/08, Urabe Shyouhei <shyouhei@ruby-lang.org> wrote:

[#17549] Re: 1.8 release management — Igal Koshevoy <igal@...> 2008/07/03

Wilson Bilkovich wrote:

[#17555] Re: 1.8 release management — "Luis Lavena" <luislavena@...> 2008/07/03

On Thu, Jul 3, 2008 at 4:41 PM, Igal Koshevoy <igal@pragmaticraft.com> wrote:

[#17585] Re: 1.8 release management — Urabe Shyouhei <shyouhei@...> 2008/07/04

Luis Lavena wrote:

[#17588] Re: 1.8 release management — Igal Koshevoy <igal@...> 2008/07/04

Urabe Shyouhei wrote:

[#17589] Re: 1.8 release management — Urabe Shyouhei <shyouhei@...> 2008/07/04

Igal Koshevoy wrote:

[#17591] Re: 1.8 release management — Igal Koshevoy <igal@...> 2008/07/04

Urabe Shyouhei wrote:

[#17593] Re: 1.8 release management — "Vladimir Sizikov" <vsizikov@...> 2008/07/04

Hi,

[ruby-core:17426] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk

From: Urabe Shyouhei <shyouhei@...>
Date: 2008-06-29 05:41:27 UTC
List: ruby-core #17426
Igal Koshevoy wrote:
> For the sake of protecting Ruby's good image, I believe it's necessary
> to ship an *official* version that's compatible and addresses these
> vulnerabilities as soon as possible. After that's shipped, resolving
> the matter with the API changes in the current code will likely be a
> priority. If there's anything that we in the Ruby community can help
> you with, please ask. :)

Yes.  Please write a patch :)

I know your concerns.  I know you all need a stable Ruby, rather than a
beautifully working Ruby.  Actually that's why I'm still maintaining
1.8.6.  And sorry again for its unexpectedly unstable.

But honestly I'm doubtful for urgency of current situation.  If things
are that dangerous someone might be writing patches, like some people
did for p230.  I think p230 was dangerous enough.  But now that fixes
are made,  it seems it's less urgent.  I think we should wait for fixes
made into 1.8.6, rather than reverting to p114 + a security fix.  If you
can't wait please fix it by yourself; we are very grateful to merge that
into our repository.  In other words,  I think it's not that urgent
because no one seems to trying to fix those APIs.

Anyway, p238 source code can be downloaded via
http://svn.ruby-lang.org/repos/ruby/tags/v1_8_6_238

In This Thread